Implement basic Authentication for rest api using Jersey 2

Question

I have exposed some rest api using Jersey 2(Tomcat server) and successfully implemented Basic authentication(only needed authentication stuff not authorization) using ContainerRequestFilter filter as below

public class AuthFilter implements ContainerRequestFilter{

    @Context
    HttpServletRequest request;

    @Override
    public void filter(ContainerRequestContext context)  {
     ............................
     //getting username/password authorization header and validating

When I told the same to my Lead, he said don't use filters as every time your rest api is hit, this filter will get invoked.Therefore, implement basic authentication security at container level.I am using Tomcat server. In web.xml, this is defined

<servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>

Is the above he is referring to? Can anyone please guide me how to implement the way my lead is saying?

Maybe this will help

Paul Samsotha
– Paul Samsotha

2015-02-19 05:57:07 +00:00
Commented Feb 19, 2015 at 5:57 — Paul Samsotha
– Paul Samsotha, Commented Feb 19, 2015 at 5:57

svarog · Accepted Answer · 2020-01-06 13:20:28Z

2

The documentation gives you examples on how to configure this via web.xml. You'll need to configure this using a login-config that belongs to a realm. The web container then takes care of securing resources based on URL patterns.

Note that the data is sent in plain text (in encoded form) via a HTTP header, so you'll need to think of ways to ensure that is not snooped on (like HTTPS).
Whether you check this header on a filter or on the container does not relieve you of the overhead required for making the check (which is probably negligible, but I've never profiled this area of the code to quote numbers).

edited Jan 6, 2020 at 13:20

svarog

9,8755 gold badges66 silver badges79 bronze badges

answered Feb 19, 2015 at 5:43

Deepak Bala

11.2k2 gold badges40 silver badges49 bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

Anand Over a year ago

What is realm here? Also, to clarify I only need to do authentication part not authorization.

Deepak Bala Over a year ago

A realm can be a file based or database based authentication store. tomcat-users.xml is an XML based file realm.

Anand Over a year ago

How to use database based authentication? In conf/server.xml, do i need to create realm? Also, what realm name should be given in web.xml?

Deepak Bala Over a year ago

Take a look at DataSourceRealm. You can choose any realm name.

Anand Over a year ago

I successfully implemented it..on hitting a rest api, dialog box pops up that asks for credentials..but i don't want it rather i want to send authorization header using some rest tool like postman, advanced rest client etc...Can u please tell me how to do that?

|

Collectives™ on Stack Overflow

Implement basic Authentication for rest api using Jersey 2

1 Answer 1

8 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

8 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related